Elevate Powershell scripts

Question

Is it possible to elevate the permissions of a powershell script so a user without admin privileges can run the script? Our network admins are trying to find more time-efficient ways to accomplish certain tasks that right now they have to use remote desktop for...automating them with PS scripts would help, but the users don't have admin rights.

Answer 1

It sounds like you are looking for a sudo equivalent in windows. Sudo is not inherent to Windows as it is to most Unix style environments. But there are several tools available that are close equivalents.

• http://sourceforge.net/projects/sudowin
• http://sudown.sourceforge.net/

Be wary when using these types of tools though. An unhardened script + sudo is a security risk.

Answer 2

if you are using V2, you can use the following which is up on the PowerShell Team Blog

Start-Process "$psHome\powershell.exe" -Verb Runas -ArgumentList '-command "Get-Process"'

This would run "Get-Process" as administrator.

If you don't have V2, you could create a StartInfo object and set the Verb to Runas like this.

function Start-Proc  {   
     param ([string]$exe = $(Throw "An executable must be specified"),[string]$arguments)       

     # Build Startinfo and set options according to parameters  
     $startinfo = new-object System.Diagnostics.ProcessStartInfo   
     $startinfo.FileName = $exe  
     $startinfo.Arguments = $arguments  
     $startinfo.verb = "RunAs"  
     $process = [System.Diagnostics.Process]::Start($startinfo)  

}

I have a blog post that talks a bit more about using a System.Diagnostics.ProcessStartInfo object.

Answer 3

The task is more like setuid than sudo ... and thankfully, setuid is possible: you can simply create a scheduled task (without a set schedule), and set it to run elevated. Then, give your users rights to execute that task. I outlined the process in a blog post awhile ago along with a PowerShell script to help create the tasks and shortcuts to run them.

The problem (as JaredPar suggested) is that you have to make sure that the apps which you have scheduled to run elevated or "as administrator" are protected, and this is especially true if you will run a script. Make sure noone but the administrator(s) can edit or replace that script, or you're giving away the proverbial keys to the kingdom.

Answer 4

The Powershell Community Extensions include a cmdlet for this, alias 'su'. http://www.codeplex.com/Pscx